Action inbox
The action inbox (/inbox, sidebar under ACTION) merges three sources
into a single work queue, so you no longer walk three pages to know
what needs attention today:
| Source | Examples |
|---|---|
| Alerts | CPU threshold, disk full, app down, agent offline |
| Recommendations | CVEs (OS + dependencies), certs, capacity, updates |
| Detections | SSH brute force, new login countries, new USB devices |
How it works
Section titled “How it works”- Every row gets a normalized severity (
critical/high/medium/low/info). Alert severitywarningmaps tomediumso sorting stays consistent across sources. - Filter by source or severity; per-filter counters are shown in the buttons.
- Hostnames are clickable and jump straight to the right tab on agent detail (see deep-links below).
- Actions coming from recommendations (restart, dep-fix-script) run through the existing Emergency Action Tokens: monsys never executes anything on its own, the operator confirms with TOTP.
Deep-links on agent detail
Section titled “Deep-links on agent detail”Every tab on agent detail is URL-addressable via ?tab=:
/agents/<id>?tab=kernel, ?tab=cves, ?tab=disks, and so on.
All list pages (alerts, SLA, kernel CVEs, detections, inventory, trust
score, recommendations) link with this parameter to exactly the tab
that holds the underlying data.